Tag Archives: Cybercrime

This article is the first of a new series of Viewpoints from Harvard Business School, Sorbonne Business School and ESSEC Business School students and faculty. Viewpoints section is dedicated to opinions and views that pertain to issues of broad interest to the cybersecurity community, typically, but not exclusively, of a nontechnical nature. Controversial issues will not be avoided but be dealt with fairly. Authors are welcome to submit carefully reasoned “Viewpoints” in which positions are substantiated by facts or principled arguments. Moreover, this section periodically hosts editorial debates in a Point/Counterpoint format in which both sides of an issue are represented.

Non-consensual Pornography: How petty desire becomes a tragedy to an individual.

Viewpoint by Heeju ROH (Harvard Business School)

There was a woman.
She did an ordinary love.

It was not a love life that bares all things, believes all things, hopes all things, and endures all things. But there was an affection: she and her lover couldn’t say each other’s name without smiling. There was a trust. The two people did not feel guilty about their own unspoken things. There were a lot other things and the love brought all of them. They thought, as it is commonly said, that they fell in love. However, it was wrong. By nature, love is not something you can consciously fall into. Love strikes people as if it is an accident. So it was rather obvious that it was also the love who called the end.

As left-overs, they did not know how to deal with the situation because they were both victims. Since the love already left them, their frustration lost its direction to head and destined to wrong targets – each other. Through the time of hurting each other more and more, they somehow survived as two separate individuals. And that was supposed to be it. But one day, she was told that there are pictures and videos of her privacy online. Records of their love, including evidences of the intimacy. Indeed, she could see two bodies. One of those had the same face with hers. However there was a difference between the face in the monitor with the face that she reflects on a mirror every morning. The face in the monitor did not have dignity or self-respect. It did not have a name or identity. It was merely a visual material to facilitate the ejaculation. Yet, it was undoubtedly her face and body.

I admit. Above case cannot possibly be the only background story of nonconsensual pornographies (NCP) in this big world. Maybe there are other victims who has been through a bad breakup, an abusive relationship, or other terrible situation before the leakage. Even if an uploader has built an aggression toward a victim, he or she does not earn an authority to share the private moment with unspecified mass viewers. We all should agree that the distribution of such material cannot be justified under any circumstance, period. However, we are often misled by the name ‘Revenge Porn.’ We are misled in a way that the victims are deserved to be revenged. More importantly, this perception results a general tendency to highlight an interpersonal and emotional conflict between the perpetrator and the victim, while diluting the fact that the NCP is a collective cybercrime. No wonder why bystanders who are unlikely to commit such crime shows certain level of approval upon NCP[i].

So, do I want to claim that NCPs are not really the result of ‘revenge’? Maybe, but that’s not the point. Currently, frequently suggested strategies to stop the NCP is more focused to victims’ protecting themselves. The reasons said are 1) that the victim must’ve agreed on the intercourse itself and 2) that, due to the highly viral environment of online platforms, the identification of the victim and instant reaction is better taken by the first party, the victim, than by the third party, the law enforcement for example. This could be also why even well-respected Medias rather recommend victims to “make sure that your face is not on the picture” or “use more secured application.”[ii] This tendency is an unfiltered evidence of our ignorance. The ignorance about the magnitude of the damage to the victims and the ignorance about the nature of the situation – the crime. The society forces the victims should be the one taking the burden of erasing fees and legal procedures, while dealing with PTSD, trust issues, and hostile social perception of “you deserve it”[iii]. Compare to the severe physical and psychological pain of the victims, the purpose of the NCP is ridiculously shallow – the amusement.

In the online world, we easily let ourselves indulge. Online world is the perfect place to let all of us to swim in the sea of our own gluttony, envy, greed and lust. Of course, it is rather acceptable if the voyeurism is directed to something not ethically challenging, such as mother’s recipe for the banana cake. Sharing information is the accomplishment of the 3rd industrial revolution. However, behind the curtain of anonymity, we also can consume other people’s private life easily and casually. And as the word ‘we’ suggests, there hardly is a sole perpetrator in the online world. They commit to this cyberbullying by creating, consuming, distributing, and making profit from NCPs. When facing the collective wave of violent behavior, individual victims always fail to protect themselves. Examples of victories are absolute minority considering the entire number of victims. The victory has to become our social norm, the general outcome, and expected result.

I believe that laws, policies, and systems are to stand at the front line of this battle. People’s feeling safe from possible harassments is the first job for normal nations to achieve. If people can hurt others and be hurt by the technology facilitated sexual violence without any rational expectation to be salvaged, that status is rather similar to the fight of all against all. To end this fight, we need more victim-focused responses. From the investigation processes, which are often traumatic for victims, to subsidy for erasing the materials and punishing the distributors[iv]. There have been studies and implementation of policies conducted. However, in reality, victims are rather to rely on civil associations than on law enforcement, because the civil associations tend to have more experience in such cases[v]. While the NCPs have become more accessible and affordable, the prosecutorial process has not become victim-friendly. Victims have to endure the ongoing tragedy until the legal process is over, which does not guarantee a fresh clean-up. As a result, the victims are easily left in the blind spot of the system.

Screaming requires a lot more effort than you think. It is not a knee-jerk reflection. Firstly the lungs have to be inflated as big as possible. Then your abdomen has to be flat and tighten in order to expectorate the air. At the moment of exhalation, the vocal cord tremors to deliver the sound wave. It’s a duty of nasal cavity to increase the sound frequency. Finally, as a quasi-verbal communication, this single-syllable sound has to deliver a message: Somebody help me. Unfortunately, the brain cannot often orchestrate the process. It endeavors to send signals to your lungs, abs, and vocal cords, but they simply fails in doing their works.

She felt that she had to scream at the moment she found her pictures. If the screaming was a cardio exercise, her brain must have sweated to be dehydrated. But the brain cannot sweat. So something else did instead: Her eyes released vast amount of salty water. Taking that as a signal, the other body parts finally responded. But it was different from what she imagined. The sound was rather low and growling. It was similar to something that every creatures make in the time of tragedy. It was an ordinary end of an ordinary love. However, because tragedies does not have an eye, they sometimes just barge into an ordinary life. So her ordinary life suddenly became tragic.

On the website, she also found other women. The women who also had faces and bodies without the name and dignity. She wondered what made all these women exposed. What have they done? And she realized that she already knew the answer – an ordinary love. They all did an ordinary love – no more, no less. Just an ordinary love.

* This article does not mean the victimization of all women nor generalization of all men.

Introduction

In order to stay competitive, financial industry must seize the opportunities of the on-going technological disruption, and particularly with the recent so-called blockchain innovation when some argue that this new technology has the potential to replace banks as financial intermediaries for transfer and exchanges of money. In this transitional context, financial sector could face new cybersecurity risks, with sophisticated attacks, which eventually call for a renewed regulation framework. Here the financial sector means banks, insurers, asset managers, and advisory firms.

Blockchain can be defined as “a peer-to-peer operated public digital ledger that records all transactions executed for a particular asset (…) The Blockchain maintains this record across a network of computers, and anyone on the network can access the ledger. Blockchain is ‘decentralised’ meaning people on the network maintain the ledger, requiring no central or third party intermediary involvement. […] Users known as ‘miners’ use specialized software to look for these time stamped ‘blocks’, verify their accuracy using a special algorithm, and add the block to the chain. The chain maintains chronological order for all blocks added because of these time-stamps.” (Alderman, 2015)

Hence, Blockchain, well known through the so-called bit coin, could open much more perspective and should guaranty security and the validation of all the exchange of data. In addition to open room for new business opportunities, this new technology could disrupt the legal conception of privacy, intellectual property right, and presents some issues regarding financial institution accountability given the new associated risks. As a consequence while financial institutions have been under strengths by the new regulatory requirements in the aftermath of the 2008 financial crisis, they might see their accountability rises again to address cybersecurity risks and associated prejudices related to blockchain innovation.

This paper explains how business compliance to new cyber regulatory framework is a strategic issue for financial institutions. It presents the financial institutions specific data profile and linked eventual collateral damages. It highlights blockchain innovation opportunities and associated new cybercrime challenges. It describes the current European regulatory framework and legal accountability scenarios. It then finally supports the hypothesis of cyber compliance as a corporate competitive advantage and maps out some elements
of potential recommendations to strengthen cybersecurity resilience.

Cybersecurity and the Internet of Things

Sarah Baker, Grégoire Frison-Roche, Barbora Kuncikova

Abstract:

The Internet of Things (IoT) is a topic that gets a lot of attention and has become somewhat of buzzword in business and technology today. In many ways, this hype and excitement is not misplaced, as IoT has fascinating implications and opportunities for both consumers and businesses. However, the cybersecurity threats that this explosive growth represents are sometimes overlooked or not clearly understood. This paper will introduce the concept of IoT, including the definition, trends and applications. The next section will discuss the potential cybersecurity risks for IoT, for both industries and consumers. Finally, the last section will discuss recommended preventative measures and defense mechanisms available, while considering the fast changing nature of IoT technology.

Introduction: What is the Internet of Things?

The past decades have seen huge advances in electronic communications, from the rise of the Internet to the ubiquity of mobile devices. However, this communication is now shifting from devices that simply connect users to the Internet, to communication linking the physical world to the cyber world (Borgia, 2014). Generally speaking, this notion is called Cyber Physical Systems (CPS) and includes technologies such as (i) automation of knowledge work, (ii) Internet of Things, (iii) advanced robotics, and (iv) autonomous/ near autonomous vehicles (Borgia, 2014). However, IoT is considered to be the CPS technology with the largest expected economic impact (Manyika et al., 2013).

Given IoT is one of the most talked about trends in IT, there are as many definitions of the phenomena as there are angles to study. The origins of the concept IoT can be traced back to a group at MIT, who defined it as “an intelligent infrastructure linking objects, information and people through the computer networks, and where the RFID technology found the basis for its realization’’ (Brock, 2001). Today, IoT extends far beyond RFID technology. A more recent definition describes IoT as “a highly interconnected network of heterogeneous entities such as tags, sensors, embedded devices, handheld devices and backend servers” (Malina et al., 2016). The International Telecommunication Union (ITU) describes IoT as “anytime, any place connectivity for anyone… connectivity for anything. Connections will multiply and create an entirely new dynamic network of networks – an Internet of Things’’ (ITU, 2005).

Therefore, the defining attribute of IoT is that it involves things, moving beyond networked computers, tablets or smartphones to include just about any physical object that can be connected and communicate. The value offered by IoT comes from the fact that these objects which are not machines, and do not function like machines are able to gather and communicate data, which means information can be translated into action at astounding rates (Burrus, 2014). The concept behind IoT was aptly captured back in 1999:

“If we had computers that knew everything there was to know about things — using data they gathered without any help from us — we would be able to track and count everything, and greatly reduce waste, loss and cost. We would know when things needed replacing, repairing or recalling, and whether they were fresh or past their best. The Internet of Things has the potential to change the world, just as the Internet did. Maybe even more so” (Ashton, 2009)

Cybersecurity & Cyber Threats in Healthcare Organizations

Aurore Le Bris, Walid El Asri

Abstract:

Cybersecurity has become a strategic issue for healthcare facilities. This current risky situation comes from an internal double threat: the misuse of IT systems by employees due to their low risk awareness and the lack of proper funding dedicating to Information Security. Simultaneously, the democratization of hacking techniques has also increased the number of potential perpetrators and the variety of their profile. The multiplication of healthcare facilities hit by such attacks reveals how absolutely necessary the question of cybersecurity is. Thanks to the mediatization of these incidents, concerns now grow among general public and authorities, which trigger more and more initiatives to turn things around: FDA, AHA, HITRUST in the USA. A move towards more coordination in necessary. Furthermore, facilities’ staff is essential in solving the hacking issues. Indeed, cybersecurity cannot be improved without training employees to use devices properly, raising their awareness on cyber threats and ensuring their compliance with security policies.

Introduction

Cybersecurity has become a crucial issue for many organizations but also for private individuals. As well as for “regular” crime, anyone may become a target of ill-intentioned people, exploiting the vulnerabilities of information systems (IS) in any possible way. Healthcare organizations are some of the entities we trust the most and that hold the most sensitive information about us: name, date and place of birth, medical records, social security details, etc. Suffering from many flaws (low budget, lack of IT organization, excessive use of legacy systems…), healthcare actors have become easy targets for hackers, facing more and more pressure and threats from them (Fu and Blum, 2013).

This article aims at depicting the current state of cybersecurity in healthcare organizations as well as at understanding the main cyber threats they face and how these last ones could be addressed.

First of all, the stakes and risks associated to the healthcare environment will be presented. The different types of assets likely to be targeted will be reviewed as well as the profile of the potential attackers/threats and their objectives. Then, examples of attack scenarios – that occurred in real life or pentests – will be studied in order to highlight the consequences they may have on healthcare IS. Finally, the current state of cybersecurity in healthcare facilities will be portrayed and possible measures to enhance it will be discussed.

A Strategic Approach to the Tor Network

Why should firms go dark?

François Courset,­ Margot Favennec, Candice Hamou

Abstract:

The dark web should be considered by companies for various reasons. It offers a large panel of useful tools that can be crucial for negotiation or security. Moreover, even if it can appear as a niche network, opening an onion version of the companies’ websites might help them to boost their image. It can also bring new users to the website, users that usually cannot reach it because of censorship issues. Finally, we have seen new emerging trends related to the dark web. The Tor network might be seen in the future as a guarantee of security online but it can also deeply change the way data are used. Taking into consideration the dark web, not only as a place of illegal activities, but also as a new channel with its own opportunities and constraints is thus essential for all decision-­makers.

Introduction: For the Web is dark, and full of terrors?

The Dark Web has been fascinating and fueling the imagination of many Internet users for a few years now. The collective art group Mediengruppe Bitnik even created a Random Darknet Shoper, a bot which bought a random object from the darknet market place Agora and then sent it to the two artists in charge of the project. This artistic project, aiming at debunking consumerism, showed yet that drugs are not the only things you can find on the Dark Net. You can also find everything you buy in the “clean world”, and buy these with a refund service -­ the two artists received a refund for a bag that was no longer available.

The Dark Web, instead of being the place gathering the worst side of humanity (drugs, pedophilian contents…) could also thus be a place where a real economy grows and prospers.

That’s why the following question deserves to be asked: can the Dark Web be profitable for firms then? Could a reliable “dark” business model exists and could the dark web be used as a almost regular tool to increase a firm’s profit?

First things first, the Dark Web is often misperceived among the global population since the media hype mainly focuses on scandals such as Silk Road’s. This tends to depict it as a place where you can find barely anything illegal, from drugs to hitmen. Yet the Dark Web is not only about illegal traffic. It is much more than that. What’s more, a distinction has to be made, a distinction that is far to often forgotten or neglected. As shown by the two pictures you will find in the report (page 3), there are different levels beneath the “Surface Web” we all know. First comes the “Deep Web”, where you can find many reports, storage datas, and again underneath this Deep Web comes the “Dark Web”, where all communications are encrypted. Now let’s clarify what each term means:

Deep Web: information not accessible with a regular search engine. It is a Web concept regarding search engine (Bergman, 2001).

The Deep Web has a far larger content that the Surface Web: 1GO of indexed page versus 550GO of deep web page and 19TB of indexed content versus 7500 TB of deep web content, to quote only but a few numbers from a recent study. To be really thorough, Dark Nets are all the overlay networks on the Deepweb, and Dark Web is the content of some Darknets. Thus one DarkWeb may be considered as a small portion of Deep Web. Deep Web and DarkWeb are very often confond, yet they are not the same!

We chose to focus on Tor since this is what most people use to get into Darknets and to browse the Web anonimously. Tor enables you to protect your privacy while looking at any webcontent, and from our point of view, this is one crucial asset for a business model based on the use of Darknets. In the wake of the growing yearn for privacy and of protest against wild data collection, Tor is definitely something firms should get interested in.